- #111
- #110
- #109
- #108
- #107
- #106
- #105
- #104
- #103
- #102
- #101
- #100
- #99
- #98
- #97
- #96
- #95
- #94
- #93
- #92
- #91
- #90
- #89
- #88
- #87
- #86
- #85
- #84
- #83
- #82
- #81
- #80
- #79
- #78
- #77
- #76
- #75
- #74
- #73
- #72
- #71
- #70
- #69
- #68
- #67
- #66
- #65
- #64
- #63
- #62
- #61
- #60
- #59
- #58
- #57
- #56
- #55
- #54
- #53
- #52
- #51
- #50
- #49
- #48
- #47
- #46
- #45
- #44
- #43
- #42
- #41
- #40
- #39
- #38
- #37
- #36
- #35
- #34
- #33
- #32
- #31
- #30
- #29
- #28
- #27
- #26
- #25
- #24
- #23
- #22
- #21
- #20
- #19
- #18
- #17
- #16
- #15
- #14
- #13
- #12
- #11
- #10
- #9
- #8
- #7
- #6
- #5
- #4
How long has it been since you upgraded the package versions of your project?
Upgrading package versions is the most effective way to avoid vulnerabilities. Although it is very important, it is often difficult to face formally. Upgrading packages usually brings the following feelings:
- It feels like nothing meaningful has been produced.
- The painful process of reviewing documentation to understand the differences between old and new versions, and resolving issues caused by breaking changes.
In my experience, due to years of neglecting updates on an old project, the entire project gradually became a chunk of code that was very difficult to upgrade, with too many things to change… maybe next time 😑. We should find ways to alleviate the pain points of version upgrades, such as if the code is hosted on GitHub and you don’t mind using GitHub Actions, you can try Dependabot for a painless introduction to automating the detection of package updates. I’ve also seen some projects use Renovate, or tools like NX, which also provide commands for automated updates.
- #3
- #2
- #1